How can I generate a deterministic evenly distributed random number in a blockchain

Here's the hypothetical. There's a blockchain, which for the sake of simplicity, is modelled around Bitcoin and proof-of-work.

My goal, is that for each mined block, rather than a set reward (12.5 BTC), each block has a deterministic reward value, and that value can only be determined after the block has been submitted. Here's the process:

1. The miner constructs a block.

2. Once a block hash under target has been found (through POW), the miner submits the block, not yet knowing the reward they will receive for mining that block, because it is computationally complex to derive it.

3. Once outside the reach of possibly manipulating the output hash to optimise the value, likely by time passing "mining" the value, the value for that block is finally uncovered, and is easy to verify as quickly from the block hash.

I've looked at a few possible solutions for this, like collecting entropy from previous blocks, future blocks, etc., but it always comes back to the issue of actors optimising blocks to get a good final value for the block.

The second issue I've thought of, is how solutions to the values of blocks will be distributed in the network. How would a solution to the block value be stored? Could they be sent in parallel to the blocks, and then each client can verify the solutions as they receive them?

• What is ‘evenly distributed’? Suppose you make the reward a function of the leading zeros $\ell$ beyond some minimum network threshold $k<\ell$, say $\ell^2$ (chosen arbitrarily). There's an incentive to do more work if you get exactly $k$ leading zeros, but there's also an incentive to publish what you have rather than lose it, so there is a distribution of possible rewards. (Also: Have you considered hobbies that don't accelerate cooking the planet?) – Squeamish Ossifrage May 25 '18 at 20:03
• Maybe this Ethereum article may interest you, where the vulnerability of some blockchain-contract based prng's are broken/predicted. Might give you some ideas. – Ruben De Smet May 25 '18 at 20:34
• @SqueamishOssifrage by evenly distributed, I mean that a given input is equally likely to give any number from 0 to the maximum for that number of bits. Perhaps I'm using the wrong term! – ihatecsv May 28 '18 at 12:21
• Although random number generation is is certainly on topic here, it might be a better idea to post things like these on the Ethereum site as they are probably more likely to be answered there. – Maarten Bodewes May 17 '19 at 12:51
• Random is not your problem. You have a marketing problem. Given the diminishing ROI on mining, and increasing capex/opex requirements, why should I bother? I can easily project cash flow/return based on 12.5₿/block. Why should I expend resources for a highly risky unknown ROR? How would you sell a random block reward to a pool/investor? Your operational protocol will have to look for (random block reward) > (min.threshold). Ironically, paralleling the mining algo. – Paul Uszak Aug 1 '19 at 20:51